A digital signature scheme is a method of ensuring the authenticity of digital messages which is unforgeable by its recipient and undeniable by its sender. It consists of two efficient (polynomial time) algorithms:
1. A generation algorithm G, which computes a signature S from a message M and from a random string R (i.e., S=G(M,R)). Since the algorithm is probabilistic, the same message can have many different signatures. The parameters of G are called the private key, and only the signer knows them. PA0 2. A verification algorithm V, which decides whether a given S is a valid signature of a given message M (i.e., V(M,S)=yes or no). The parameters of V are called the public key, and everyone can find them in a public key directory.
The obvious condition which every digital signature scheme should satisfy is that: for any M and R, V(M,G(M,R))=yes. In addition, finding any S which satisfies V(M,S)=yes for a given M should be extremely difficult when the signer's private key is unknown. The precise formalization of this intuitive security requirement is quite subtle, and can be found e.g. in Goldwasser, Micali and Rivest[1988]: A Digital Signature Scheme Secure Against Adaptive Chosen Message Attacks. SIAM Journal of Computing, Vol. 17, No. 2, April 1988, pp. 281-308.
Almost all the practical digital signature schemes proposed so far are based on arithmetic operations modulo a large modulus n. The earliest example of such a signature scheme is the RSA scheme (Rivest, Shamir, and Adleman (1978]): A Method for Obtaining Digital Signatures and Public Key Cryptosystems, Communications of the ACM, Vol. 21, No. 2, February 1978, pp. 120-126, whose security is based on (but not known to be provably equivalent to) the difficulty of factoring the modulus n. Unfortunately, the generation of signatures in the RSA scheme requires many (.gtoreq.750) modular multiplications of large (.gtoreq.512 bit) numbers, and is thus quite slow. The recently introduced DSA (Digital Signature Algorithm[1991]): Specifications of a Digital Signature Algorithm, National Institute of Standards and Technology, Draft, August 1991 is based on (but not known to be equivalent to) the difficulty of computing discrete logarithms modulo large primes, and its efficiency is comparable to that of the RSA scheme. The FS scheme (Fiat and Shamir[1986]): How to Prove Yourself: Practical Solutions to Identification and Signature Problems, Proc. Crypto 86, August 1986, pp. 186-194 is considerably faster, but it still requires 30 to 60 modular multiplications. Many other variants of large-modulus schemes exist, but most of the really fast proposals (such as the OSS scheme (Ong Schnorr and Shamir[1984): An Efficient Signature Scheme Based on Quadratic Equations, Proceedings 16th ACM Symp. Theory of Computing, May 1984, pp. 208-216, and the OS scheme (Okamoto and Shiraishi[1985]): A Fast Signature Scheme Based on Quadratic Inequalities, Proc. 1985 Symp. on Security and Privacy, April 1985 which require just a few modular multiplications to generate and verify signatures) were shown to be vulnerable to sophisticated number-theoretic attacks developed by Pollard and Brickell.